449 matches found
CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...
EUVD-2026-65518
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...
CVE-2026-70551
CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory via VCS remote download. A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL , redirecting the server's request to an attacker-controlle...
CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...
PT-2026-81333
Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.161.19 JFrog Artifactory versions prior to 7.146.36 Description An authenticated user with permissions to read an existing remote Version Control System VCS repository can trigger server-side requests. Thi...
CVE-2026-75531
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
EUVD-2026-60465
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
PT-2026-76828
Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Stored cross-site scripting XSS occurs during the rendering of URL observables. A URL associated with an analyzed file is inserted directly into the inline JavaScript onclick handler of the...
PT-2026-99946
Name of the Vulnerable Software and Affected Versions Axios versions 1.16.1 through 1.19.x Description A regular expression used for RFC 2397 compliance allows slash characters on both sides of the media-type separator. When an application processes a malformed data URL containing numerous slash...
CVE-2026-19246 HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function downloadimagedataurl of the file nanobot/providers/imagegeneration.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the...
EUVD-2026-54680
A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function downloadimagedataurl of the file nanobot/providers/imagegeneration.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the...
PT-2026-69149
Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.1 Description An issue exists in the Provider-returned Image URL Handler component within the download image data url function of the nanobot/providers/image generation.py file. This flaw allows a remote...
EUVD-2026-54080
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths in SVG images encoded as data-URI. An attacker can access arbitrary files from the server's filesystem by embedding a reference to a local file within a base64-encoded SVG image,...
CVE-2026-15628
The CVE-2026-15628 affects zhayujie chatgpt-on-wechat CowAgent ≤ 2.1.1, specifically the Vision Tool’s Vision._download_to_data_url function. A manipulation of the image argument enables server-side request forgery, allowing remote initiation of attacks. Exploitation is supported by public disclo...
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Stored XSS to Account Takeover via Model Profile Images in Open WebUIAffected: Open WebUI = 0.9.5Bypass of: GHSA-3wgj-c2hg-vm6q, GHSA-3856-3vxq-m6fc--- TL;DROpen WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The...
PYSEC-2026-2694 Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
As part of our research on improving our AI pentest, we have uncovered the following issue in Open WebUI. We've manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report. Summary The channel webhook create/update flow accepts arbitrar...
PT-2026-59339
As part of our research on improving our AI pentest, we have uncovered the following issue in Open WebUI. We've manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report. Summary The channel webhook create/update flow accepts arbitrar...